Attackers Can Use the 9K Corps Mixed Domains Leak for Account Takeover

9K Corps Mixed Domains: 8,451 Corporate Email Credentials Exposed

On 11-Feb-2023, HEROIC analysts identified a combolist titled "9k Corps mixed Domains" uploaded by a Telegram user. The file contained 8,451 records, each pairing an email address with a plaintext password and the URL of the login page it was captured from.

Why This Is Dangerous

The "mixed domains" label in this list's name suggests the credentials span multiple organizations rather than a single company, meaning attackers can use it to attempt account takeover across many different businesses at once. Because the passwords are plaintext and already tied to specific login URLs, there is no cracking involved. An attacker can move straight to testing each account.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs identifying the login page for each account

Why This Matters

Attackers can use a mixed-domain combolist like this one for credential stuffing across corporate email logins, VPNs, and internal portals, betting that at least some employees reused a password from a personal account. If successful, this can lead to business email compromise, identity theft, or financial fraud that reaches well beyond the individual whose credentials were exposed.

How Combolists Work

A combolist is a compiled file of email-and-password pairs, often gathered from multiple breaches, phishing campaigns, or stealer malware infections and then grouped by theme, in this case a mix of corporate ("Corps") domains, before being shared or sold on Telegram and dark web forums. Grouping credentials this way helps buyers target organizations rather than random individuals.

Check If You Are Affected

If your work or personal email address is one of the 8,451 records in this leak, you need to know before an attacker tries it first. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can confirm your exposure and update any reused passwords right away.